CVE-2026-40013

A flaw was found in Dovecot. An authenticated attacker can submit a specially crafted Sieve script containing an extreme numeric literal to the ManageSieve service. This action triggers an out-of-bounds write during script compilation, leading to memory corruption and a crash of the ManageSieve process. This vulnerability results in a denial of service for script management and might also be leveraged for remote code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the ManageSieve service if remote Sieve script management is not required. This can typically be achieved by removing sieve from the protocols setting in your Dovecot configuration (e.g., in /etc/dovecot/dovecot.conf or a file in /etc/dovecot/conf.d/). For example, change protocols = imap pop3 lmtp sieve to protocols = imap pop3 lmtp. After modifying the configuration, the Dovecot service must be restarted for the changes to take effect using systemctl restart dovecot. Disabling this service will prevent users from remotely managing their Sieve scripts.